Privacy policy
Last updated: 2026-10-15
Brisa Works (Spain; support@brisaworks.com) makes small software tools sold through app stores. This policy explains what each tool processes and why. We collect as little as each tool needs to work.
Who is responsible
- For your account and billing data, we are the controller.
- For the content you process with a tool (emails, pages, store orders, files), you or your organisation are the controller and we act as processor under our data processing agreement, unless a tool's row below says it never leaves your account.
What each tool processes
| Tool | Data it reads | Where it goes | What we store | Retention |
|---|---|---|---|---|
| Tasks ⇄ Notion (Google Workspace add-on) | Google Tasks in the lists you map (title, notes, due date, done state, task link) via the tasks scope; the Notion database you share with it; your Google account email (userinfo.email) |
Tasks data goes only to the Notion workspace you connect, under your own Notion authorization; it runs inside your Google account (Apps Script), not on our servers. Your email goes to our licence server (Cloudflare) to check your plan. | On our servers: your email, plan and subscription status (from Paddle). In your Google account only: settings, your Notion access token, and sync state (task IDs, page IDs, short hashes of synced fields, a log of the last 100 changes) | Licence record: while the subscription exists and 30 days after it ends (deleted automatically); invoices 6 years (Paddle). Data in your Google account: until you press Disconnect in the add-on, which deletes it (press it before uninstalling) |
| Click & Drop Customs (Shopify app) | Paid orders: recipient name, shipping address, email and phone; order lines, values and weights; product customs metafields | Order and recipient data go only to your own Royal Mail Click & Drop account over its API, to create the shipment; tracking numbers come back to your Shopify order. Hosted on Cloudflare | Your Click & Drop API key (AES-256-GCM encrypted), settings, cached plan, and per-order sync status (Shopify order ID and number, Click & Drop order number, destination region, redacted error text). No customer names, addresses, emails or phones. Customs data stays in your store as product metafields | Sync log 30 days; sync status while installed; everything deleted at once on uninstall or shop/redact; a customer's order rows deleted on customers/redact |
| Gantt for Sheets (Google Sheets editor add-on) | Only the spreadsheet you run it in (spreadsheets.currentonly): task names, dates, durations, dependencies, % done and owner columns you map; your Google account email (userinfo.email) |
Plan data stays in your spreadsheet: scheduling runs inside your Google account (Apps Script) and PDFs are made in your browser; nothing is sent to our servers. Your email goes to our licence server (Cloudflare) once a day to check your plan. | On our servers: your email, plan and subscription status (from Paddle). In your spreadsheet and Google account only: computed dates, the Gantt tab, baseline columns, your column choices and calendar settings (document properties), and a one-day licence cache (user properties) | Licence record: while the subscription exists and 30 days after it ends (deleted automatically); invoices 6 years (Paddle). Data in your spreadsheet: until you delete it; uninstalling stops all processing |
| Ansible Workbench and SCons Support (JetBrains IDE plugins) | Your project files, only on your own machine, to give code insight; Ansible Workbench passes Vault passwords to your own ansible-vault in memory |
Nowhere: the plugins run on your machine and send nothing to us. Ansible Workbench's optional Node.js download goes to nodejs.org when you start it. Paid licences are checked by your IDE with JetBrains | Nothing on our servers. JetBrains Marketplace handles purchases and licences under its own privacy notice | Not applicable |
| Apify Actors (all eight: keyword volume, AI JSON extractor, App Store reviews, Shopify products, PageSpeed, Wayback history, EU VAT validator, RSS monitor) | Only the run input you give (keywords, URLs, app IDs, store URLs, feed URLs, VAT numbers and expected names/addresses) and the public data each Actor fetches for it. API keys you enter (DataForSEO, Anthropic, Google) are Apify secret inputs. Apify tells us your Apify username and usage for billing | Results go only to your own Apify storages (dataset, key-value store). Requests go to the source you chose: DataForSEO, Anthropic, Google PageSpeed Insights, Apple's review feed, the Shopify store, the Internet Archive or the EU VIES service; keys go only to their own service, under your own account. Runs on Apify's platform (Apify is the processor; we never see your data unless you share a run with us for support) | Nothing on our servers. In your Apify account only: run results, and for the monitor modes a small state store (Shopify product prices/stock snapshot, PageSpeed last score per URL, RSS seen item IDs and ETags) | Run results: your Apify data retention settings. Monitor state: until you delete the named store in your Apify account | | Apify Actors: personal-data notes | App Store reviewer nicknames are dropped unless you switch them on. RSS author fields are never collected. Shopify: product catalogue fields only. EU VAT validator: for sole traders the registered name and address returned by VIES are personal data | You are the controller of what you collect; for the VAT validator, use it only to check your own counterparties (VIES terms). Review and page texts are sent to Anthropic only if you add your own Anthropic key | Nothing beyond the run | As above |
(One row per product, filled from its design doc. Google user data: see the next section.)
Google user data (Workspace add-ons)
Our Google Workspace add-ons' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We read only the data a scope needs for the action you take, we do not sell it, use it for advertising, or use it to train AI models, and humans do not read it except with your explicit consent for support, for security, or where the law requires.
Billing
Purchases outside app stores are processed by Paddle (Paddle.com Market Ltd), our merchant of record, under Paddle's privacy notice. Store purchases are handled by the store (JetBrains, Shopify, Apify). We receive the buyer's name, email, country and licence status.
Processors we use
Cloudflare (hosting, email routing), Paddle (payments), Apify Technologies s.r.o. (runs our Apify Actors, EU), Anthropic (only for tools whose row says AI processing; inputs are not used to train models under Anthropic's commercial terms; our Apify Actors call Anthropic only with your own API key). A current list is kept on this page.
Legal bases
Contract (providing the tool you installed), legitimate interest (security, abuse prevention, fixing errors from anonymous error reports), and legal obligation (invoices kept 6 years under Spanish law).
Your rights
Access, rectification, erasure, restriction, portability and objection: write to support@brisaworks.com. You can complain to the Spanish Data Protection Agency (www.aepd.es). Uninstalling a tool stops processing; we delete its stored data within 30 days.
International transfers
Where a processor is outside the EEA, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.